Analysis
-
max time kernel
128s -
max time network
147s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
25/06/2022, 07:54
Static task
static1
Behavioral task
behavioral1
Sample
bumblebee.dll
Resource
win10-20220414-en
windows10_x64
General
-
Target
run.bat
-
Size
58B
-
MD5
21f479b64e1b4cac98f71d55d928a124
-
SHA1
a5381cb0557dc3d1ec5a1ce8f76a97adc3d9f4ec
-
SHA256
6ae8417806a564871b70d7adb4baa557a1ad1cf6f4b61efbff7b00c8bbca1a7a
-
SHA512
c8ef4a263eefe2f2ded6e146614dd102aa8b41051a7a8e670fa1e3683e608feba507f18ae5a3a5de337df264492c074d489504109909e0afab9b3ee502960315
Malware Config
Extracted
bumblebee
236r
54.38.136.111:443
103.200.32.188:492
74.57.128.223:112
13.2.200.200:338
228.194.82.251:473
247.224.208.140:372
0.151.228.146:282
192.119.77.241:443
186.150.217.235:221
50.41.225.93:478
50.167.186.112:239
173.77.219.120:201
187.210.45.242:299
239.11.133.48:421
207.6.99.3:471
98.28.11.39:201
193.239.152.108:242
133.209.39.126:217
146.19.173.202:443
97.194.155.116:446
86.91.101.57:221
101.8.100.194:131
152.38.148.148:494
89.172.3.185:315
138.114.199.166:316
69.120.31.126:408
74.135.94.210:347
204.233.101.71:459
168.120.139.16:273
204.181.129.183:248
172.110.248.55:203
25.170.215.18:456
82.20.113.198:446
106.120.29.13:489
246.47.222.240:216
103.175.16.47:443
24.121.25.160:346
28.53.120.108:270
211.131.243.77:112
246.232.135.28:477
49.179.166.100:235
146.19.173.207:443
206.103.180.253:205
215.48.4.118:123
224.239.200.236:443
Signatures
-
Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest rundll32.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ rundll32.exe -
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions rundll32.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion rundll32.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3578829114-180201921-3281645608-1000\SOFTWARE\Wine rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe 2260 rundll32.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3984 wrote to memory of 2260 3984 cmd.exe 67 PID 3984 wrote to memory of 2260 3984 cmd.exe 67
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\run.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bumblebee.dll,PjyJGGCvQs2⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious behavior: EnumeratesProcesses
PID:2260
-